A function calling method of an SO file and a related device
By parsing and mapping the function call information of SO files, and creating encrypted functions in newly created SO files, the development burden and difficulty in function call statistics during SO file version updates are solved, thereby improving security and information hiding.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- WUHAN DOUYU NETWORK TECHNOLOGY CO LTD
- Filing Date
- 2021-07-02
- Publication Date
- 2026-07-03
Smart Images
Figure CN115562710B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of dynamic link library technology, and in particular to a function calling method for SO files and related equipment. Background Technology
[0002] SO files are dynamic link library files in .so format. Almost every SO file calls system functions, and the import table in an SO file exposes the names of the system SO files and system functions called by that SO file. This poses a certain security risk. Attackers can analyze the import table of an SO file to find out which system functions it calls, what operations it performs, and then look for vulnerabilities, create viruses, and steal user information.
[0003] Currently, there are generally two methods to prevent the system functions called by SO files from being exposed: one is to dynamically load system functions, thus avoiding adding them to the import table; the other is to implement system functions themselves, so that the SO file does not need to call them. Existing technologies require special modifications to the code during the development phase of the SO file each time an application version update containing the SO file is released. This places a significant burden on developers and makes subsequent operations such as statistics and searches for system function calls inconvenient. Summary of the Invention
[0004] In view of the above problems, the present invention provides a function calling method and related device for SO files. The main purpose is to solve two types of problems when SO files hide the system functions they call. First, each time an application version update containing SO files is released, it is necessary to redevelop each SO file and make special modifications to the code during the development stage, which will cause a great burden to the developers. Second, it is inconvenient to perform subsequent operations such as statistics and search for system function calls.
[0005] To address the aforementioned technical problems, in a first aspect, the present invention provides a function call method for SO files, the method comprising:
[0006] Parse and obtain all function call information of the first SO file, wherein the function call information includes a first name and a second name, the first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file;
[0007] Establish a mapping relationship between the encrypted name and the second name. Based on the mapping relationship, create a second function in the second SO file. The second SO file is a newly created SO file. The name of the second function is the encrypted name. The second function is used to implement the function of the system function corresponding to the second name.
[0008] Replace the first name of each of the first SO files with the name of the second SO file;
[0009] Replace the second name of each of the first SO files with the name of the corresponding second function.
[0010] Optionally, the number of characters in the name of the second SO file is equal to the minimum number of characters in the first name, and / or the number of characters in the encrypted name is equal to the number of characters in the corresponding second name.
[0011] Optionally, the step of replacing the first name of each of the first SO files with the name of the second SO file includes:
[0012] When the number of characters in the name of the second SO file is less than the number of characters in the name of the first SO file, the first name of each first SO file is replaced with the name of the second SO file, and a string terminator is added after the replaced first name.
[0013] And / or,
[0014] The step of replacing the second name of each of the first SO files with the name of the corresponding second function includes:
[0015] When the number of characters in the encrypted name is less than the number of characters in the second name, the second name of each of the first SO files is replaced with the name of the corresponding second function, and a string terminator is added after the replaced second name.
[0016] Optionally, the function call information may also include:
[0017] The first offset of the first name in the first SO file and the second offset of the second name in the first SO file;
[0018] Optionally, the step of parsing and obtaining all function call information of the first SO file includes:
[0019] All the first names and all the second names are stored in a first variable, wherein the first variable is a key-value pair collection structure, the key stores the first name, and the value stores the corresponding second name;
[0020] The step of creating the second function in the second SO file includes:
[0021] Based on the first variable, create the second function in the second SO file.
[0022] Optionally, the step of parsing and obtaining all function call information of the first SO file includes:
[0023] The first name and the first offset are stored in a second variable corresponding to each of the first SO files, wherein the second variable is a key-value pair set structure, the key stores the first name, and the value stores the first offset;
[0024] The step of replacing the first name of each of the first SO files with the name of the second SO file includes:
[0025] Based on the second variable, the first name of each of the first SO files is replaced with the name of the second SO file.
[0026] Optionally, the step of parsing and obtaining all function call information of the first SO file includes:
[0027] The first name, the second name, and the second offset are stored in a third variable corresponding to each first SO file, wherein the third variable is a key-value pair structure, the key stores the first name, and the value stores the second name and the second offset;
[0028] The step of replacing the second name of each of the first SO files with the name of the corresponding second function includes:
[0029] Based on the third variable, the second name of each of the first SO files is replaced with the name of the corresponding second function.
[0030] To achieve the above objectives, according to a second aspect of the present invention, a function calling device for an SO file is provided, comprising:
[0031] The parsing unit is used to parse and obtain the function call information of all first SO files, wherein the function call information includes a first name and a second name, the first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file;
[0032] The mapping unit is used to establish a mapping relationship between the encrypted name and the second name, and to create a second function in the second SO file according to the mapping relationship. The second SO file is a newly created SO file, the name of the second function is the encrypted name, and the second function is used to implement the function of the system function corresponding to the second name.
[0033] The first replacement unit is used to replace the first name of each of the first SO files with the name of the second SO file;
[0034] The second replacement unit is used to replace the second name of each of the first SO files with the name of the corresponding second function.
[0035] To achieve the above objectives, according to a third aspect of the present invention, a storage medium is provided, the storage medium including a stored program, wherein, when the program is executed, the device where the storage medium is located executes the function call method of the SO file described in any one of the first aspects.
[0036] To achieve the above objectives, according to a fourth aspect of the present invention, an apparatus is provided, the apparatus comprising at least one processor and at least one memory connected to the processor; wherein the processor is configured to invoke program instructions in the memory to execute the function call method of an SO file as described in any one aspect.
[0037] By employing the above technical solution, this invention provides a method and related equipment for function calls in SO files. The main objective is to solve two problems related to the current practice of hiding system functions called by SO files: first, each application version update containing SO files requires the redevelopment of each SO file, necessitating special code modifications during development, which places a heavy burden on developers; second, it hinders subsequent statistical analysis and searching of system function calls. This invention obtains function call information from all first SO files through parsing. This function call information includes a first name and a second name. The first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file. A mapping relationship is established between the encrypted name and the second name. Based on this mapping relationship, a second function is created in a second SO file. The second SO file is a newly created SO file, and the name of the second function is the encrypted name. The second function implements the functionality of the system function corresponding to the second name. The first name of each first SO file is replaced with the name of the second SO file. The second name of each first SO file is replaced with the name of the corresponding second function, thus realizing function calls in the SO files. In the above scheme, the function call information of all first SO files is obtained by parsing, so that the function call relationship of the first SO files can be adjusted in subsequent operations. A mapping relationship is established between the encrypted name and the second name. Based on this mapping relationship, a second function is created in the second SO file, implementing all called system functions in the second SO file, so that the function call relationship of the first SO files can be adjusted in subsequent operations. By replacing the first name of each first SO file with the name of the second SO file, the call of the first SO file to the system SO file is modified to call the second SO file, hiding the name of the system SO file called by the first SO file, thus improving the security and information hiding effect of the first SO files. By replacing the second name of each first SO file with the name of the corresponding second function, the call of the first SO file to the system function is modified to call the function in the second SO file, modifying and hiding the name of the system function called by the first SO file, thus improving the security and information hiding effect of the first SO files.The above solution eliminates the need to redevelop the first SO file every time an application version update containing the first SO file is released, and hides the system function calls of the first SO file without requiring special code modifications during the development phase. Instead, it automatically processes all first SO files at once during application integration and packaging, thereby modifying and hiding the system functions called by the first SO file, reducing the burden on developers, and facilitating operations such as statistics and searches of system function calls based on the mapping relationship. Attached Figure Description
[0038] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of exemplary embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:
[0039] Figure 1 This is a flowchart of a function call method for an SO file provided in Embodiment 1 of the present invention;
[0040] Figure 2 This is a flowchart of a function call method for an SO file provided in Embodiment 2 of the present invention;
[0041] Figure 3 This is a schematic structural block diagram of a function call device for an SO file provided in Embodiment 3 of the present invention;
[0042] Figure 4 This is a schematic structural block diagram of a device provided in Embodiment 5 of the present invention. Detailed Implementation
[0043] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.
[0044] Example 1
[0045] To address two issues currently encountered when hiding system functions called by SO files: firstly, each application update containing an SO file requires the redevelopment of each SO file, necessitating special code modifications during development and placing a significant burden on developers; secondly, it hinders subsequent operations such as statistics and searches of system function calls. Embodiment 1 of this invention provides a method for calling functions using SO files, such as... Figure 1 As shown, the method includes:
[0046] Step 101: Parse and obtain all function call information from the first SO file;
[0047] The function call information includes a first name and a second name. The first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file. The first SO file is an SO file used for program packaging.
[0048] Specifically, there may be one or more first SO files. In this embodiment, the number of first SO files is not limited. The import table of the SO file will record the system function information called by this SO file. The function call information can be obtained by parsing the import table of the first SO file.
[0049] It should be noted that the function call information of the first SO file can be obtained through step 101, so that the function call relationship of the first SO file can be adjusted subsequently.
[0050] Step 102: Establish a mapping relationship between the encrypted name and the second name, and create a second function in the second SO file based on the mapping relationship;
[0051] The second SO file is a newly created SO file, the name of the second function is the encrypted name, and the second function is used to implement the function of the system function corresponding to the second name.
[0052] Specifically, the mapping relationship between the encrypted name and the second name can be stored in a list. The mapping relationship stored in the list can be presented in key-value pair form, with one encrypted name corresponding to one second name. This embodiment does not limit the storage method of the mapping relationship. The encryption method of the encrypted name can be string replacement or function encryption. For example, the encrypted name corresponding to the second name "open" is "xxxx", or the second name encrypted by algorithms such as MD5 and SHA-2 can be used as the corresponding encrypted name. This embodiment does not limit the encryption method. When the second function implements the function of the corresponding system function, the corresponding system function can be called directly inside the second function. The second SO file is an SO file created to achieve the effect of modifying and hiding the system function called by the first SO file in this invention.
[0053] It should be noted that step 102 can implement all the system functions called in the second SO file so that the function call relationships in the first SO file can be adjusted in subsequent operations.
[0054] For example, if the partial code of the system function corresponding to the second name "dlopen" is "void*dlopen(const char*pathName,int mode);", then the code of the second function is:
[0055] void*dlopen(const char*pathName,int mode){
[0056] return dlopen(pathName, mode);
[0057] }
[0058] Here, "dlopen" is the function name of the second function, "(const char*pathName,int mode)" is the parameter required by the second function, and "return dlopen(pathName,mode);" returns the function of the corresponding system function.
[0059] It should be noted that the above code is used to implement the second function.
[0060] Optionally, the number of characters in the name of the second SO file is equal to the minimum number of characters in the first name.
[0061] Specifically, if the first SO file has a first name of 4 characters and a first name of 5 characters in its import table, the name of the second SO file can only have 4 characters.
[0062] Optionally, the number of characters in the encrypted name is equal to the number of characters in the corresponding second name.
[0063] Specifically, in the import table of the first SO file, the 4-character second name and the 5-character second name correspond to the 4-character encrypted name and the 5-character encrypted name, respectively.
[0064] It should be noted that the lengths of the first name and the second name stored in the import table of the first SO file are fixed. If the lengths of the file name and the encrypted name of the second SO file used for replacement are greater than their respective lengths, the data will be written out of bounds, resulting in corruption of the SO file format content. The two optional features mentioned above can effectively avoid this situation.
[0065] Step 103: Replace the first name of each first SO file with the name of the second SO file;
[0066] Specifically, iterate through all the first SO files and change the first name in the import table to the name of the second SO file.
[0067] It should be noted that step 103 can modify the call of the first SO file to the system SO file to call the second SO file, thus hiding the name of the system SO file called by the first SO file and improving the security and information hiding effect of the first SO file.
[0068] Step 104: Replace the second name of each first SO file with the name of the corresponding second function;
[0069] Specifically, iterate through all the first SO files and modify the second name in the import table to the name of the second function.
[0070] It should be noted that step 104 can modify the call to system functions in the first SO file to call functions in the second SO file, thereby modifying and hiding the names of the system functions called by the first SO file, which improves the security and information hiding effect of the first SO file.
[0071] Optionally, step 103 may include: when the number of characters in the name of the second SO file is less than the number of characters in the name of the first SO file, replacing the first name of each first SO file with the name of the second SO file, and adding a string terminator after the replaced first name.
[0072] Specifically, "0" can be used as a string terminator and added after the first name after the replacement.
[0073] Optionally, step 104 may include: when the number of characters in the encrypted name is less than the number of characters in the second name, replacing the second name of each first SO file with the name of the corresponding second function, and adding a string terminator after the replaced second name.
[0074] Specifically, "0" can be used as a string terminator and added after the first name after the replacement.
[0075] It should be noted that the lengths of the first name and the second name stored in the import table of the first SO file are fixed. If the lengths of the file name and the encrypted name of the second SO file used for replacement are greater than their respective lengths, the data will be written out of bounds, resulting in corruption of the SO file format content. The two optional features mentioned above can effectively avoid this situation and can hide the lengths of the names of system files and system functions called by the first SO file, thus better modifying and hiding the system functions called by the first SO file.
[0076] By employing the above technical solutions, Embodiment 1 of this invention provides a method for calling functions in SO files. This addresses two problems encountered when SO files hide the system functions they call: first, each application update containing SO files requires the redevelopment of each SO file, necessitating special code modifications during development, which places a heavy burden on developers; second, it hinders subsequent statistical analysis and searching of system function calls. This invention obtains function call information from all first SO files through parsing. This function call information includes a first name and a second name. The first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file. A mapping relationship is established between the encrypted name and the second name. Based on this mapping relationship, a second function is created in the second SO file. The second SO file is a newly created SO file, and the name of the second function is an encrypted name. The second function implements the functionality of the system function corresponding to the second name. The first name of each first SO file is replaced with the name of the second SO file. The second name of each first SO file is replaced with the name of the corresponding second function, thus realizing the function call functionality of the SO files. In the above scheme, the function call information of all first SO files is obtained through parsing, so that the function call relationship of the first SO files can be adjusted in subsequent operations. By establishing a mapping relationship between encrypted names and second names, and creating second functions in the second SO files according to the mapping relationship, all called system functions are implemented in the second SO files, so that the function call relationship of the first SO files can be adjusted in subsequent operations. By replacing the first name of each first SO file with the name of the second SO file, the calls of the first SO files to system SO files are modified to calls to the second SO files, hiding the names of the system SO files called by the first SO files, thus improving the security and information hiding effect of the first SO files. By replacing the second name of each first SO file with the name of the corresponding second function, the calls of the first SO files to system functions are modified to calls to functions in the second SO files, thus modifying and hiding the names of the system functions called by the first SO files, further improving the security and information hiding effect of the first SO files. The above solution eliminates the need to redevelop the first SO file every time an application version update containing the first SO file is released, and hides the system function calls of the first SO file without requiring special code modifications during the development phase. Instead, it automatically processes all first SO files at once during application integration and packaging, thereby modifying and hiding the system functions called by the first SO file, reducing the burden on developers, and facilitating operations such as statistics and searches of system function calls based on the mapping relationship.
[0077] Example 2
[0078] To enable those skilled in the art to more thoroughly understand the present invention and to fully convey the scope of the invention to them, Embodiment Two of the present invention, based on Embodiment One described above, further explains a method for calling a function in an SO file as defined by the present invention, such as... Figure 2 As shown, the method includes:
[0079] Step 201: Parse and obtain all function call information from the first SO file;
[0080] The function call information includes a first name, a second name, a first offset of the first name in the first SO file, and a second offset of the second name in the first SO file. The first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file. The first SO file is an SO file used for program packaging.
[0081] Specifically, after the program development is completed, all the first SO files developed have been released in a final version. At this time, for all the first SO files packaged by the program, all the first SO files in the package directory are traversed and an SO file list is generated. The SO file list can have one or more first SO files. In this embodiment, the number of first SO files is not limited. The import table of the SO file will record the first name and the second name called by this SO file. The first name and the second name can be obtained by parsing the import table of the first SO file. The first offset and the second offset can be obtained by parsing the storage location of the first name and the second name in the first SO file.
[0082] It should be noted that step 201 can obtain the function call information of the first SO file, so that the function call information can be stored in variables and the function call relationship of the first SO file can be adjusted.
[0083] For example, a list of SO files can be created using the following code:
[0084] Vector <string>solist;
[0085] Here, "Vector" indicates that the created list structure is a dynamic array, "string" indicates that each first SO file is stored using a string variable, and "solist" is the name of the SO file list.
[0086] It should be noted that the above code is used to create a list of SO files. Traversing the first SO file through the list of SO files is more efficient than directly traversing the first SO file.
[0087] Step 202: Store all the first names and all the second names into a first variable;
[0088] The first variable is a key-value pair set structure, where the key stores the first name and the value stores the corresponding second name.
[0089] Specifically, the first variable can be a map. <string,vector <string>The variable is structured as follows: the first variable stores function call information for all first SO files. The map object is a key-value pair, where the key is the name of the system SO file in string format, and the value is a dynamic array corresponding to the functions in the system SO files that were called by the first SO file.
[0090] It should be noted that all first SO files share a single first variable. The data stored in the first variable is in a deduplicated aggregation form, which avoids storing the same data repeatedly and thus occupying too much memory space.
[0091] For example, the first variable is created by the following code:
[0092] map <string,vector <string>>importInfo;
[0093] For example, if one first SO file calls the funcA function in the system's A.so, and another first SO file calls the funcA and funcA2 functions in the system's A.so, then the information stored in importInfo would be {"A.so", {"funcA", "funcA2"}}.
[0094] Here, "map" indicates that the variable is stored as a key-value pair structure. The first "string" is the key in the key-value pair, used to store the name of the system SO file, and "verctor" is the key in the key-value pair. <string>" is the value in the key-value pair, used to store the name of the system function corresponding to the name of the system SO file.
[0095] It should be noted that the above examples do not limit the storage structure of the variables or the specific application scenarios of this technical feature, but are made for the purpose of enabling those skilled in the art to more thoroughly understand the present invention.
[0096] Step 203: Store the first name and the first offset into the second variable corresponding to each first SO file;
[0097] The second variable is a key-value pair structure, where the key stores the first name and the value stores the first offset.
[0098] Specifically, the second variable can be a map.<string,uint64> The structure contains variables, each second variable corresponding to the function call information of each first SO file. The map object is a key-value pair, where the key is the system SO file name in string format and the value is the offset of the system SO file name called by the first SO file in uint64 format within the first SO file.
[0099] It should be noted that each first SO file corresponds to a second variable, so as to facilitate the adjustment of the calling relationship of each first SO file in the future.
[0100] For example, the second variable is created by the following code:
[0101] map<string,uint64> soOffset;
[0102] For example, if a first SO file calls two system SO files, one is A.so and the other is B.so, then the soOffset variable will store {{"A.so",offsetA},{"B.so",offsetB}}.
[0103] Here, "map" indicates that the variable storage structure is a key-value pair structure. The first "string" is the key in the key-value pair, used to store the name of the system SO file. "uint64" is the value in the key-value pair, used to store the offset of the name of the system SO file called by the first SO file in the first SO file. "offsetA" is the offset of the name of the A.so file called by the first SO file in the first SO file in the first SO file. "offsetB" is the offset of the name of the B.so file called by the first SO file in the first SO file in the first SO file.
[0104] It should be noted that the above examples do not limit the storage structure of the variables or the specific application scenarios of this technical feature, but are made for the purpose of enabling those skilled in the art to more thoroughly understand the present invention.
[0105] Step 204: Store the first name, the second name, and the second offset into a third variable corresponding to each first SO file;
[0106] The third variable is a key-value pair structure, where the key stores the first name and the value stores the second name and the second offset.
[0107] Specifically, the third variable can be a map. <string,vector <info>The variables in the structure are as follows: each third variable stores function call information for each first SO file. The map object is a key-value pair, where the key is the system SO file name in string format and the value is an Info structure. The Info structure includes a system function name in string format and the offset of the system function name in uint64 format in the first SO file.
[0108] It should be noted that each first SO file corresponds to a third variable, so as to facilitate the adjustment of the calling relationship of each first SO file in the future.
[0109] For example, a third variable is created using the following code:
[0110] map <string,vector <info>>funcinfo;
[0111] For example, if a first SO file calls two system SO files, A.so and B.so, and A.so calls the system function "funcA", while B.so calls the system functions "funcB1" and "funcB2", then the funcinfo variable will store {{"A.so",{"funcA",funcAoffset},{"B.so",{"funcB1",funcB1offset},{"B.so",{"funcB2",funcB2offset}}.
[0112] Here, "map" indicates that the variable storage structure is a key-value pair structure. The first "string" is the key in the key-value pair, used to store the name of the system SO file. "uint64" is the value in the key-value pair, used to store the offset of the system function name called by the first SO file in the first SO file. "funcAoffset" is the offset of "funcA" in the first SO file, "funcB1offset" is the offset of "funcB1" in the first SO file, and "funcB2offset" is the offset of "funcB2" in the first SO file.
[0113] It should be noted that the above examples do not limit the storage structure of the variables or the specific application scenarios of this technical feature, but are made for the purpose of enabling those skilled in the art to more thoroughly understand the present invention.
[0114] Step 205: Establish a mapping relationship between the encrypted name and the second name. Based on the mapping relationship and the first variable, create a second function in the second SO file.
[0115] The second SO file is a newly created SO file, the name of the second function is the encrypted name, and the second function is used to implement the function of the system function corresponding to the second name.
[0116] Specifically, the mapping relationship between the encrypted name and the second name can be stored in a list. The mapping relationship stored in the list can be presented in key-value pair form, with one encrypted name corresponding to one second name. This embodiment does not limit the storage method of the mapping relationship. The encryption method of the encrypted name can be string replacement or function encryption. For example, the encrypted name corresponding to the second name "open" is "xxxx", or the second name encrypted by algorithms such as MD5 and SHA-2 can be used as the corresponding encrypted name. This embodiment does not limit the encryption method. When the second function implements the function of the corresponding system function, the corresponding system function can be called directly inside the second function. The second function is created based on the system function name stored in the first variable. The second SO file is an SO file created to achieve the effect of modifying and hiding the system function called by the first SO file in this invention.
[0117] It should be noted that step 205 can implement all the system functions called in the second SO file, so that the function call relationship of the first SO file can be adjusted in subsequent operations. By creating the second function based on the first variable, it is possible to avoid traversing the system SO file to find the system functions called in the first SO file, thus improving the creation efficiency.
[0118] For example, if the partial code of the system function corresponding to the second name "dlopen" is "void*dlopen(const char*pathName,int mode);", then the code of the second function is:
[0119] void*dlopen(const char*pathName,int mode){
[0120] return dlopen(pathName, mode);
[0121] }
[0122] Here, "dlopen" is the name of the second function, "(const char*pathName,int mode)" is the parameter required by the second function, and "return dlopen(pathName,mode);" returns the function of the corresponding system function.
[0123] It should be noted that the above code is used to implement the second function.
[0124] Optionally, the number of characters in the name of the second SO file is equal to the minimum number of characters in the first name.
[0125] Specifically, if the first SO file has a first name of 4 characters and a first name of 5 characters in its import table, the name of the second SO file can only have 4 characters.
[0126] Optionally, the number of characters in the encrypted name is equal to the number of characters in the corresponding second name.
[0127] Specifically, in the import table of the first SO file, the 4-character second name and the 5-character second name correspond to the 4-character encrypted name and the 5-character encrypted name, respectively.
[0128] It should be noted that the lengths of the first name and the second name stored in the import table of the first SO file are fixed. If the lengths of the file name and the encrypted name of the second SO file used for replacement are greater than their respective lengths, the data will be written out of bounds, resulting in corruption of the SO file format content. The two optional features mentioned above can effectively avoid this situation.
[0129] Step 206: Based on the second variable, replace the first name of each first SO file with the name of the second SO file;
[0130] Specifically, iterate through all the first SO files, and based on the first name and first offset stored in the second variable, modify the first name at the first offset in the import table to the name of the second SO file.
[0131] It should be noted that step 206 can modify the call of the first SO file to the system SO file to call the second SO file, hiding the name of the system SO file called by the first SO file, thus improving the security and information hiding effect of the first SO file. By modifying the first name according to the second variable, the first name to be modified can be found quickly and accurately and modified, thus improving the modification efficiency.
[0132] Step 207: Based on the third variable, replace the second name of each first SO file with the name of the corresponding second function;
[0133] Specifically, it iterates through all the first SO files, and based on the first name, second name, and second offset stored in the third variable, it modifies the second name at the second offset in the import table to the name of the second function. By modifying the second name based on the third variable, the second name to be modified can be found quickly and accurately and modified, thus improving the modification efficiency.
[0134] It should be noted that step 207 can modify the call to system functions in the first SO file to call functions in the second SO file, thereby modifying and hiding the names of the system functions called by the first SO file, improving the security and information hiding effect of the first SO file. By modifying the second name according to the third variable, the second name to be modified can be found quickly and accurately and modified, improving the modification efficiency.
[0135] Optionally, step 206 may include: when the number of characters in the name of the second SO file is less than the number of characters in the name of the first SO file, replacing the first name of each first SO file with the name of the second SO file, and adding a string terminator after the replaced first name.
[0136] Specifically, "0" can be used as a string terminator and added after the first name after the replacement.
[0137] Optionally, step 207 may include: when the number of characters in the encrypted name is less than the number of characters in the second name, replacing the second name of each first SO file with the name of the corresponding second function, and adding a string terminator after the replaced second name.
[0138] Specifically, "0" can be used as a string terminator and added after the first name after the replacement.
[0139] It should be noted that the lengths of the first name and the second name stored in the import table of the first SO file are fixed. If the lengths of the file name and the encrypted name of the second SO file used for replacement are greater than their respective lengths, the data will be written out of bounds, resulting in corruption of the SO file format content. The two optional features mentioned above can effectively avoid this situation and can hide the lengths of the names of system files and system functions called by the first SO file, thus better modifying and hiding the system functions called by the first SO file.
[0140] By employing the above technical solutions, Embodiment 1 of this invention provides a function call method for SO files. This addresses two problems encountered when SO files hide the system functions they call: first, each application version update containing SO files requires the redevelopment of each SO file, necessitating special code modifications during development, which places a significant burden on developers; second, it hinders subsequent statistical analysis and searching of system function calls. This invention parses and obtains function call information from all first SO files, stores all first names and all second names in a first variable, stores the first name and first offset in a second variable corresponding to each first SO file, and stores the first name, second name, and second offset in a third variable corresponding to each first SO file, establishing a mapping relationship between encrypted names and second names. Based on this mapping relationship and the first variable, a second function is created in the second SO file. Based on the second variable, the first name of each first SO file is replaced with the name of the second SO file, and based on the third variable, the second name of each first SO file is replaced with the name of the corresponding second function, thus realizing function calls from SO files.In the above scheme, the function call information of all first SO files is obtained by parsing, so that the function call information can be stored in variables and the function call relationship of the first SO files can be adjusted. By storing all first names and all second names into a first variable, the operation of repeatedly storing the same data avoids occupying too much memory space. By storing the first name and the first offset into a second variable corresponding to each first SO file, each first SO file corresponds to a second variable, which facilitates the adjustment of the call relationship of each first SO file. By storing the first name, the second name, and the second offset into a third variable corresponding to each first SO file, each first SO file corresponds to a third variable, which facilitates the adjustment of the call relationship of each first SO file. By establishing a mapping relationship between encrypted names and second names, the mapping is used to... The operation of creating a second function in the second SO file, based on the relationship and the first variable, implements all system functions called in the second SO file, so that subsequent operations can adjust the function call relationship of the first SO file and improve creation efficiency. By replacing the first name of each first SO file with the name of the second SO file according to the second variable, the calls from the first SO file to system SO files are modified to calls to the second SO file, hiding the names of the system SO files called by the first SO file, improving the security and information hiding effect of the first SO file, and increasing modification efficiency. By replacing the second name of each first SO file with the name of the corresponding second function according to the third variable, the calls from the first SO file to system functions are modified to calls to functions in the second SO file, modifying and hiding the names of the system functions called by the first SO file, improving the security and information hiding effect of the first SO file, and increasing overall efficiency. The above solution eliminates the need to redevelop the first SO file every time an application version update containing the first SO file is released, and hides the system function calls of the first SO file without requiring special code modifications during the development phase. Instead, it automatically processes all first SO files at once during application integration and packaging, thereby modifying and hiding the system functions called by the first SO file, reducing the burden on developers, and facilitating operations such as statistics and searches of system function calls based on the mapping relationship.
[0141] Example 3
[0142] Furthermore, as a response to the aforementioned Figure 1 To implement the method shown, Embodiment 3 of the present invention also provides an electronic device for implementing the function call method of SO files, used to implement the aforementioned Method Embodiment 1. This electronic device embodiment corresponds to the aforementioned Method Embodiment 1. For ease of reading, this electronic device embodiment will not repeat the details of the aforementioned Method Embodiment 1, but it should be clear that the electronic device in this embodiment can correspondingly implement all the contents of the aforementioned Method Embodiment 1. For example... Figure 3 As shown, the electronic device 30 includes: a parsing unit 301, a mapping unit 302, a first replacement unit 303, and a second replacement unit 304, wherein,
[0143] The parsing unit 301 is used to parse and obtain the function call information of all first SO files. The function call information includes a first name and a second name. The first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file.
[0144] Mapping unit 302 is used to establish a mapping relationship between the encrypted name and the second name, and to create a second function in the second SO file according to the mapping relationship. The second SO file is a newly created SO file, the name of the second function is the encrypted name, and the second function is used to implement the function of the system function corresponding to the second name.
[0145] The first replacement unit 303 is used to replace the first name of each first SO file with the name of the second SO file;
[0146] The second replacement unit 304 is used to replace the second name of each first SO file with the name of the corresponding second function.
[0147] By employing the above technical solutions, Embodiment 3 of the present invention provides an electronic device for implementing a function call method for SO files. This addresses two problems encountered when SO files hide the system functions they call: first, each time an application version update containing SO files is released, each SO file needs to be redeveloped, requiring special modifications to the code during the development phase, which places a significant burden on developers; second, it is inconvenient for subsequent operations such as statistics and searches of system function calls. The present invention obtains the function call information of all first SO files through parsing. This function call information includes a first name and a second name. The first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file. A mapping relationship is established between the encrypted name and the second name. Based on this mapping relationship, a second function is created in the second SO file. The second SO file is a newly created SO file, and the name of the second function is an encrypted name. The second function implements the functionality of the system function corresponding to the second name. The first name of each first SO file is replaced with the name of the second SO file. The second name of each first SO file is replaced with the name of the corresponding second function, thus realizing the function call of the SO file. In the above scheme, the function call information of all first SO files is obtained through parsing, so that the function call relationship of the first SO files can be adjusted in subsequent operations. By establishing a mapping relationship between encrypted names and second names, and creating second functions in the second SO files according to the mapping relationship, all called system functions are implemented in the second SO files, so that the function call relationship of the first SO files can be adjusted in subsequent operations. By replacing the first name of each first SO file with the name of the second SO file, the calls of the first SO files to system SO files are modified to calls to the second SO files, hiding the names of the system SO files called by the first SO files, thus improving the security and information hiding effect of the first SO files. By replacing the second name of each first SO file with the name of the corresponding second function, the calls of the first SO files to system functions are modified to calls to functions in the second SO files, thus modifying and hiding the names of the system functions called by the first SO files, further improving the security and information hiding effect of the first SO files. The above solution eliminates the need to redevelop the first SO file every time an application version update containing the first SO file is released, and hides the system function calls of the first SO file without requiring special code modifications during the development phase. Instead, it automatically processes all first SO files at once during application integration and packaging, thereby modifying and hiding the system functions called by the first SO file, reducing the burden on developers, and facilitating operations such as statistics and searches of system function calls based on the mapping relationship.
[0148] Example 4
[0149] Embodiment 4 of the present invention provides a storage medium on which a program is stored, which, when executed by a processor, implements the function call method of the above-mentioned SO file.
[0150] Example 5
[0151] Embodiment 5 of the present invention provides a device 40, such as Figure 4 As shown, the device includes at least one processor 401 and at least one memory 402 connected to the processor; wherein the processor 401 is used to call program instructions in the memory 402 to execute the function call method that implements the above-mentioned SO file.
[0152] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable process management device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable process management device, generate instructions for implementing the process... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0153] In a typical configuration, the device includes one or more processors (CPUs), memory, and a bus. The device may also include input / output interfaces, network interfaces, etc.
[0154] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and memory includes at least one memory chip. Memory is an example of computer-readable media.
[0155] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0156] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0157] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0158] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.< / info> < / info> < / string> < / string> < / string> < / string>
Claims
1. A function call method for SO files, characterized in that, include: Parse and obtain all function call information of the first SO file, wherein the function call information includes a first name and a second name, the first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file; Establish a mapping relationship between the encrypted name and the second name. Based on the mapping relationship, create a second function in the second SO file. The second SO file is a newly created SO file. The name of the second function is the encrypted name. The second function is used to implement the function of the system function corresponding to the second name. Replace the first name of each of the first SO files with the name of the second SO file; Replace the second name of each of the first SO files with the name of the corresponding second function.
2. The method according to claim 1, characterized in that, The number of characters in the name of the second SO file is equal to the minimum number of characters in the first name, and / or the number of characters in the encrypted name is equal to the number of characters in the corresponding second name.
3. The method according to claim 1, characterized in that, The step of replacing the first name of each of the first SO files with the name of the second SO file includes: When the number of characters in the name of the second SO file is less than the number of characters in the name of the first SO file, the first name of each first SO file is replaced with the name of the second SO file, and a string terminator is added after the replaced first name. And / or, The step of replacing the second name of each of the first SO files with the name of the corresponding second function includes: When the number of characters in the encrypted name is less than the number of characters in the second name, the second name of each of the first SO files is replaced with the name of the corresponding second function, and a string terminator is added after the replaced second name.
4. The method according to claim 1, characterized in that, The function call information also includes: The first name has a first offset in the first SO file and the second name has a second offset in the first SO file.
5. The method according to claim 4, characterized in that, The step of parsing and obtaining all function call information of the first SO file includes: All the first names and all the second names are stored in a first variable, wherein the first variable is a key-value pair set structure, the key stores the first name, and the value stores the corresponding second name; The step of creating the second function in the second SO file includes: Based on the first variable, create the second function in the second SO file.
6. The method according to claim 5, characterized in that, The step of parsing and obtaining all function call information of the first SO file includes: The first name and the first offset are stored in a second variable corresponding to each of the first SO files, wherein the second variable is a key-value pair set structure, the key stores the first name, and the value stores the first offset; The step of replacing the first name of each of the first SO files with the name of the second SO file includes: Based on the second variable, the first name of each of the first SO files is replaced with the name of the second SO file.
7. The method according to claim 6, characterized in that, The step of parsing and obtaining all function call information of the first SO file includes: The first name, the second name, and the second offset are stored in a third variable corresponding to each first SO file, wherein the third variable is a key-value pair structure, the key stores the first name, and the value stores the second name and the second offset; The step of replacing the second name of each of the first SO files with the name of the corresponding second function includes: Based on the third variable, the second name of each of the first SO files is replaced with the name of the corresponding second function.
8. A function call apparatus of a SO file, characterized by, include: The parsing unit is used to parse and obtain the function call information of all first SO files, wherein the function call information includes a first name and a second name, the first name is the name of the system SO file called by the first SO file, and the second name is the name of the system function called by the first SO file; The mapping unit is used to establish a mapping relationship between the encrypted name and the second name, and to create a second function in the second SO file according to the mapping relationship. The second SO file is a newly created SO file, the name of the second function is the encrypted name, and the second function is used to implement the function of the system function corresponding to the second name. The first replacement unit is used to replace the first name of each of the first SO files with the name of the second SO file; The second replacement unit is used to replace the second name of each of the first SO files with the name of the corresponding second function.
9. A storage medium, characterized by The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the function call method for SO files as described in any one of claims 1 to 7.
10. An apparatus, comprising: The device includes at least one processor and at least one memory connected to the processor; wherein the processor is configured to invoke program instructions in the memory to execute the function call method of the SO file as described in any one of claims 1 to 7.